CVE-2007-4515

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 33%

from disclosure to weapon1 days

Published on NVDAug 31

1st PoC+1d

metasploitAug 30

exploitation probability

33%top 2% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Buffer overflow in a certain ActiveX control in YVerInfo.dll before 2007.8.27.1 in the Yahoo! services suite for Yahoo! Messenger before 8.1.0.419 allows remote attackers to execute arbitrary code via unspecified vectors involving arguments to the (1) fvCom and (2) info methods. NOTE: some of these details are obtained from third party information.

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/4351unverified exploitdbwww.exploit-db.com/exploits/16522unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=591 http://messenger.yahoo.com/security_update.php?id=082907 http://osvdb.org/37739 http://secunia.com/advisories/26579 http://securityreason.com/securityalert/3083 http://securitytracker.com/id?1018628 https://exchange.xforce.ibmcloud.com/vulnerabilities/36363 http://www.securityfocus.com/bid/25494 http://www.vupen.com/english/advisories/2007/3011